17a507cce4066c4be7db53d64d9a9e11dfecfd4f2411393690506e591b5895cd

Analysis

max time kernel
68s
max time network
17s
platform
windows7_x64
resource
win7-20240221-de
resource tags

arch:x64arch:x86image:win7-20240221-delocale:de-deos:windows7-x64systemwindows
submitted
28-02-2024 08:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7z2401-x64.exe
Size

1.5MB
MD5

de644b4e1086f1315c422f359133543b
SHA1

54be86d121879b0e5d86604297c57a926d665fa8
SHA256

17a507cce4066c4be7db53d64d9a9e11dfecfd4f2411393690506e591b5895cd
SHA512

714d41254352d91834a4b648d613e9b4452b93b097b5781ec5bf3ec7c310a489d3a1c409b2f0a6946822b96f6943b579910d26a5f4324b320d485e856dbdcb1a
SSDEEP

49152:8yEuRNRgYQYk6tC0tkaNuiXatTQY7quUncuTVyvn65:8yEoL7tCzlqLcuBz5

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1896	7zFM.exe

Loads dropped DLL 9 IoCs

pid	Process
112	7z2401-x64.exe
112	7z2401-x64.exe
112	7z2401-x64.exe
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found
1208	Process not Found

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Uninstall.exe	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\readme.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	7z2401-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll	7z2401-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2401-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 20 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2401-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2401-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2401-x64.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeRestorePrivilege	1896	7zFM.exe
Token: 35	1896	7zFM.exe

C:\Users\Admin\AppData\Local\Temp\7z2401-x64.exe
"C:\Users\Admin\AppData\Local\Temp\7z2401-x64.exe"
1⤵
- Loads dropped DLL
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
PID:112

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\7-Zip\Lang\de.txt

Filesize
9KB

MD5
38582f79994872087e949087be309007

SHA1
7476974870949207739664d3a05ee3369b68763b

SHA256
50eb1f3dfbf20f03ed7b5edebc7b510fc94520e4c5c8d960f001427740b1fe71

SHA512
940f413f249e02010634041e2ca7f1e8320c13ef63929d08b77fd7935eaa1babc375d5441553116ad3b1192016fe048f477169ec3474d196a417cca8cfb0e48b

Download Submit
\Program Files\7-Zip\7-zip.dll

Filesize
99KB

MD5
956d826f03d88c0b5482002bb7a83412

SHA1
560658185c225d1bd274b6a18372fd7de5f336af

SHA256
f9b4944d3a5536a6f8b4d5db17d903988a3518b22fbee6e3f6019aaf44189b3d

SHA512
6503064802101bca6e25b259a2bfe38e2d8b786bf2cf588ab1fb026b755f04a20857ee27e290cf50b2667425c528313b1c02e09b7b50edbcd75a3335439c3647

Download Submit
\Program Files\7-Zip\7zFM.exe

Filesize
929KB

MD5
6156ebaea891ddbfcb1187f628ec7577

SHA1
778fd5d5dec21f95c5aa554567e06da8295b9a47

SHA256
4853947e14bf30ab40702c34f80fb113c45619a73f89a938f2284c786e35c9fe

SHA512
ed166095ceb46ff77e1081263aea03cb97b5d244a7e4060b6b37c847fd496a7e577f297846414ff130e01484f44f9da2566e2572c6cd69e9b419c311799a511a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads